488
Someone got Gab's AI chatbot to show its instructions (mbin.grits.dev)
submitted 2 years ago by to c/technology@beehaw.org
198 comments fedilink hide all child comments
 

Credit to @bontchev

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 years ago (9 children)

Only true if the second LLM follows instructions in the user's input. There is no reason to train it to do so.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 1 point 2 years ago (8 children)

    Any input to the 2nd LLM is a prompt, so if it sees the user input, then it affects the probabilities of the output.

    There's no such thing as "training an AI to follow instructions". The output is just a probibalistic function of the input. This is why a jailbreak is always possible, the probability of getting it to output something that was given as input is never 0.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 1 point 2 years ago* (7 children)
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 2 years ago (6 children)

    Ah, TIL about instruction fine-tuning. Thanks, interesting thread.

    Still, as I understand it, if the model has seen an input, then it always has a non-zero chance of reproducing it in the output.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 2 years ago (5 children)

    No. Consider a model that has been trained on a bunch of inputs, and each corresponding output has been "yes" or "no". Why would it suddenly reproduce something completely different, that coincidentally happens to be the input?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 2 years ago (4 children)

    Because it's probibalistic and in this example the user's input has been specifically crafted as the best possible jailbreak to get the output we want.

    Unless we have actually appended a non-LLM filter at the end to only allow yes/no through, the possibility for it to output something other than yes/no, even though it was explicitly instructed to, is always there. Just like how in the Gab example it was told in many different ways to never repeat the instructions, it still did.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 years ago* (3 children)

    I'm confused. How does the input for LLM 1 jailbreak LLM 2 when LLM 2 does mot follow instructions in the input?

    The Gab bot is trained to follow instructions, and it did. It's not surprising. No prompt can make it unlearn how to follow instructions.

    It would be surprising if a LLM that does not even know how to follow instructions (because it was never trained on that task at all) would suddenly spontaneously learn how to do it. A "yes/no" wouldn't even know that it can answer anything else. There is literally a 0% probability for the letter "a" being in the answer, because never once did it appear in the outputs in the training data.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 years ago* (2 children)

    Oh I see, you're saying the training set is exclusively with yes/no answers. That's called a classifier, not an LLM. But yeah, you might be able to make a reasonable "does this input and this output create a jailbreak for this set of instructions" classifier.

    Edit: found this interesting relevant article

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •